refactor: streamline Docker build process in CI configuration and documentation

Updated the CI workflow to utilize a script for generating Docker build variable overrides, simplifying the build commands for Go and Web images. Adjusted the README to reflect the new build process and clarify the usage of environment variables, enhancing overall documentation clarity.

deploy/docker/README.md

@@ -24,15 +24,15 @@
 
 ```bash
 cd deploy/docker
-docker buildx bake -f docker-bake.hcl go-images \
-  --var "REGISTRY=git.shts.su/<owner>" \
-  --var "IMAGE_TAG=latest" \
-  --var "SHORT_SHA=$(git rev-parse --short HEAD)"
-docker buildx bake -f docker-bake.hcl web-images \
-  --var "REGISTRY=git.shts.su/<owner>"
+export REGISTRY=git.shts.su/<owner>
+export IMAGE_TAG=latest
+export SHORT_SHA=$(git rev-parse --short HEAD)
+sh write-bake-override.sh
+docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl go-images
+docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl web-images
 ```
 
-Переменные из `variable` в `docker-bake.hcl` передаются флагом **`--var NAME=value`** (не `--set`: он только для полей target вроде `tags`, `args`).
+**CI:** на runner без `buildx bake --var` скрипт `write-bake-override.sh` генерирует `docker-bake.override.hcl` с нужными `variable` (файл не коммитится). Альтернатива на новом buildx: `--var REGISTRY=…` (см. `docker buildx bake --help`).
 
 Один образ (legacy):
 

deploy/docker/write-bake-override.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env sh
+# Writes docker-bake.override.hcl for CI (buildx without --var support).
+set -eu
+OUT="${1:-docker-bake.override.hcl}"
+REGISTRY="${REGISTRY:?REGISTRY required}"
+IMAGE_TAG="${IMAGE_TAG:-latest}"
+SHORT_SHA="${SHORT_SHA:-dev}"
+SHA_FULL="${SHA_FULL:-}"
+CACHE_REF_GO="${CACHE_REF_GO:-}"
+CACHE_REF_WEB="${CACHE_REF_WEB:-}"
+cat >"$OUT" <<EOF
+# Generated by deploy/docker/write-bake-override.sh — do not commit.
+variable "REGISTRY" {
+  default = "${REGISTRY}"
+}
+variable "IMAGE_TAG" {
+  default = "${IMAGE_TAG}"
+}
+variable "SHORT_SHA" {
+  default = "${SHORT_SHA}"
+}
+variable "SHA_FULL" {
+  default = "${SHA_FULL}"
+}
+variable "CACHE_REF_GO" {
+  default = "${CACHE_REF_GO}"
+}
+variable "CACHE_REF_WEB" {
+  default = "${CACHE_REF_WEB}"
+}
+EOF